> Our next project is to eliminate all 3rd party dependencies, and after that to rebuild our frontends completely using zero frameworks, not touching npm ever again after that.
What's the proportion of bugs you've encountered that was due to a library versus due to your own code? I suspect it's probably more than 1:1000.
I’m not going to eliminate every single third party dependency in my system, but I’m on my way to eliminating 90%, maybe more.
For me it’s less about bugs and more about supply chain security risk. And with AI and only building what I need from a dep, exactly how I need it, the cost of doing this is very low.
I worry that the move towards eliminating library usage will lead to further code fragmentation.
It's a nice idea, and in theory sounds great, but you may be trading 1 library with 1000 bugs for 1 million implementations each with one special bug...
If each of the 1 million bugs can only be used to exploit 1 system, the transition is from "1000 exploitable bugs per system" to "1 exploitable bug per system".
You might say that's a big "if", but you did say "1 special bug"...
The cost of finding an exploit has gone way down, but if you can only amortize that cost over a single use, then the ROI probably won't be there for a lot of them.
False dichotomy. A library that is not a 100% perfect match for a problem you have to solve, will require glue code. Any bug in the glue code is in your own code but only exists because of the library.
What's the proportion of bugs you've encountered that was due to a library versus due to your own code? I suspect it's probably more than 1:1000.
This is a stupid decision.